PeopleSoft SCM Manufacturing CVE-2026-91264

Exploitation requires network HTTP access to a PeopleSoft Enterprise SCM Manufacturing 9.2 instance and does NOT require authentication (PR:N) or user interaction (UI:N). The primary LIMITING factor is high attack complexity (AC:H): Oracle explicitly labels this 'difficult to exploit,' indicating the attacker must satisfy a condition outside their direct control (e.g., a timing/race window or a specific transient state) rather than exploiting a default configuration deterministically. Impact is further bounded to limited integrity effects - unauthorized update, insert, or delete of only 'some' accessible data - with no read access to confidential data (C:N) and no availability impact (A:N). Exposure is reduced where the SCM Manufacturing HTTP interface is not reachable from untrusted networks.

All available signals point to this being a LOW real-world priority despite being network-reachable. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) yields a base score of 3.7, driven solely by a LOW integrity impact with no confidentiality or availability impact. Two factors strongly suppress risk: AC:H ('Difficult to exploit' per Oracle's own description), meaning the attacker must win a race condition or satisfy conditions outside their control, and the scope limited to unauthorized update/insert/delete of 'some' accessible data rather than full data compromise or code execution. Although PR:N makes this nominally unauthenticated and network-accessible via HTTP, the high attack complexity meaningfully offsets that exposure. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was identified - there are no conflicting signals inflating the risk. One discrepancy to verify: the input Tags include 'Authentication Bypass,' which is not supported by the description (the flaw affects data integrity, not authentication), and the CWE is listed as N/A, so the precise weakness class is unconfirmed.

A remote, unauthenticated attacker sends specially crafted HTTP requests to an internet- or network-exposed PeopleSoft Enterprise SCM Manufacturing 9.2 instance and, by exploiting a hard-to-trigger condition, achieves limited unauthorized modification, insertion, or deletion of a subset of manufacturing data. No public proof-of-concept exploit is known, and the high attack complexity (AC:H) means reliable exploitation requires favorable timing or conditions the attacker cannot fully control. There is no confidentiality breach or service disruption in this scenario - only integrity tampering of select records.